Microsoft Downplays Revelation of Massive Data Leak
November 1, 2022
Microsoft customers have reason to be annoyed despite the company’s insistence there is nothing to see here. “Microsoft Under Fire After Leaking 2.4TB of Data from Customers Including Contracts, Emails, and More,” reveals Tech Times. Citing a report by cybersecurity firm SOCRadar, writer Joseph Henry tells us:
“According to SOCRadar post, 2.4TB of confidential data from more than 65,000 entities has been leaked because of the misconfiguration in the data bucket. The cybersecurity firm confirms that the data involved in the leak include State of Work (SoW) documents, PII (Personally Identifiable Information) data, Proof-of-Execution (PoE) data, customer emails, project details, product offers, and more. SOCRadar also notes that the above mentioned data spanned five years, particularly from 2017 to August 2022. It should be noted that Microsoft did not include the number of affected customers in its announcement. Unfortunately, instead of acknowledging SOCRadar’s finding, the Redmond giant downplayed the statement by disapproving of its post. Microsoft added that its investigation showed that no customer accounts were compromised in the process.”
Really? What a stroke of good fortune. Henry goes on to share some customer comments regarding the data leak as collected by Ars Technica. Apparently few are reassured by the company’s insistence SOCRadar is exaggerating. If nothing else, some note, this incident highlights Microsoft’s policy of retaining sensitive information in perpetuity. That is not exactly a security best practice. See the SOCRadar post for its description of the misconfiguration that caused this kerfuffle and its potential ramifications.
Which big tech giant will be the next one to get an F in security? My hunch is that it is Amazon’s turn to lose the game of cyber security musical chairs.
Cynthia Murrell, November 1, 2022
Microsoft Goggle Chunder
October 19, 2022
I can resist. I read “Microsoft’s Army Goggles Left U.S. Soldiers with Nausea, Headaches in Test.” I am not too familiar with the training drills for US military personnel. Some create some discomfort. I can here “no pain, no pain” and other friendly, supportive, positive comments.
The write up explains:
U.S. soldiers using Microsoft’s new goggles in their latest field test suffered “mission-affecting physical impairments” including headaches, eyestrain and nausea, according to a summary of the exercise compiled by the Pentagon’s testing office.
How long did it take to create the interesting side effects? Less than three hours.
The trigger for the chunder is Microsoft’s innovation Integrated Visual Augmentation System. I wonder if the acronym or code for the gizmos will be ZUCK which rhymes with upchuck? Probably not.
One government official who works in procurement allegedly said:
the service “conducted a thorough operational evaluation” and “is fully aware” of the testing office’s concerns. The Army is adjusting the program’s fielding and schedule “to allow time to develop solutions to the issues identified…”
One of the issues may be the illumination of the gizmo itself. If true, is this a device designed by those who love science fiction movies or engineers with expertise in warfighting gear? My hunch is that the video game and motion picture aficionados outnumber the combat seasoned on the headgear team.
Bolting a weapon on a robot dog might be an alternative in my opinion.
Will more information be forthcoming? My hunch is that the next report will contain more positive information. F35 pilots seem to be doing okay with their new immersive helmets. Are pilots different from other military professionals?
What if the F35 helmet approach is better than the Softies who continue to struggle with getting printers to work in a way users expect?
Stephen E Arnold, October 19, 2022
Want a Cyber Security Job But Know Zero? Will a Fake LinkedIn Profile Help You?
October 17, 2022
LinkedIn has unwittingly become a vector for the spread of false information. Krebs on Security reports, “Fake CISO Profiles on LinkedIn Target Fortune 500s.” A slew of fake LinkedIn profiles mysteriously appeared for Chief Information Security Officers purportedly serving at high-profile companies. Some were entirely original fabrications, but at least one lifted a description from the actual CISO’s profile. See the write-up for screenshots of a few offending profiles.
Who is fooled? Organizations looking for cybersecurity professionals. And not just on LinkedIn. Apparently other sources unwittingly perpetuated the lies, sources like Google Search, Apollo.io, Signalhire, Cybersecurity Ventures, and Cybercrime Magazine’s CISO 500 list. Whoever is behind the effort must have been delighted. It was apparently Honeywell’s former CISO Rich Mason who first noticed the trend and sounded the alarm. Krebs notes:
“Again, we don’t know much about who or what is behind these profiles, but in August the security firm Mandiant (recently acquired by Google) told Bloomberg that hackers working for the North Korean government have been copying resumes and profiles from leading job listing platforms LinkedIn and Indeed, as part of an elaborate scheme to land jobs at crypto currency firms. None of the profiles listed here responded to requests for comment (or to become a connection). In a statement provided to KrebsOnSecurity, LinkedIn said its teams were actively working to take these fake accounts down.”
We are sure they are. The article suggests some ways the site could make things easier on themselves in the future. Maybe even catch and remove such fabrications before they make it to other media channels. We are told:
“LinkedIn could take one simple step that would make it far easier for people to make informed decisions about whether to trust a given profile: Add a ‘created on’ date for every profile. Twitter does this, and it’s enormously helpful for filtering out a great deal of noise and unwanted communications. The former CISO Mason said LinkedIn also could experiment with offering something akin to Twitter’s verified mark to users who chose to validate that they can respond to email at the domain associated with their stated current employer. … Mason said LinkedIn also needs a more streamlined process for allowing employers to remove phony employee accounts.”
It is unlikely that we’ve seen the last of this tactic. LinkedIn should bolster its safeguards and streamline its reporting process. Meanwhile, other sources must learn to verify information they find on the site. Safeguarding one’s reputation for accurate data should be worth the effort.
Cynthia Murrell, October 17, 2022
Microsoft Teams and Sensitive Information
October 13, 2022
I read a somewhat unusual analysis of Microsoft Teams security. “Microsoft Teams Users Are Using It for a Really Bad Reason, So Stop Now” presents some data about Teams’ users and their sending information over the system. Now the purpose of Teams and similar conferencing software is to exchange information. Therefore, access to Teams sessions and the data exchanged while using the using may have some value to certain individuals if such access were available.
Okay, now let’s look at some of the numbers in the write up:
- 45 percent of those in the sample (who knows how many were in the sample by the way?) “admit to sending confidential and sensitive information frequently via Microsoft Teams.” Now let’s think about this. Does this mean that 55 percent of those using Teams do not provide “confidential or sensitive information”? Is this a measure of productivity which Teams enhances?
- 51 percent were found to be “sharing business critical information.” I am not sure I understand the distinctioin between “sensitive” and “business critical. The idea that half of those using Teams don’t share important data.
- 56 percent believe training is needed.
Net net: Microsoft may have to do more than silence Teams’ blowhards. See “Microsoft Is Working Hard to Shut Up the Egotistical Blowhard on Your Team.”
Stephen E Arnold, October 15, 2022
Russia: Inconsistent Cyber Attack Capabilities
October 7, 2022
Do you remember that Microsoft’s president Brad Smith opined that the SolarWinds’ misstep required about 1,000 engineers? I do. Let’s assume those engineers then turned their attention to compromising Ukraine as part of a special military operation.
“Failure of Russia’s Cyber Attacks on Ukraine Is Most Important Lesson for NCSC” presents information I found interesting about Mr. Smith’s SolarWinds’ remark. [The NCSC is the United Kingdom’s National Cyber Security Council.’
Here’s the key passage from the write up:
Ukrainian cyber defences, IT security industry support and international collaboration have so far prevented Russian cyber attacks from having their intended destabilising impact during Russia’s invasion of Ukraine.
The write up also points out that a cyber content marketing campaign designed to undermine Ukraine’s leadership was also not effective.
Okay, but, Mr. Smith said that Russia was able to coordinate the efforts of 1,000 individuals to breach SolarWinds’ security and create considerable distress among some in commercial enterprises and other organizations.
How could Ukraine resist this type of capable force? I have no idea. I prefer to flip the information around and ask, “Why did SolarWinds’ security yield so easily?” Did Russia put more effort into breaching SolarWinds than fighting a kinetic war? Yeah, sure it did.
Maybe the 1,000 programmer idea was hand waving and blame shifting? Microsoft cannot make printers work. Why would Microsoft security be much better?
Stephen E Arnold, September 2022
Microsoft Teams: Ho Ho Ho
September 30, 2022
That Microsoft Teams is something. I refuse to use it. Others have to use it. I am happy with Zoom. I am fortunate. I can dictate what video tool I use. You? No. Too bad. I try not to think about Teams. I admit to sending my son notices of new Teams’ features, and he has a great sense of humor and sends me smiley faces as a reply. I am not sure he is smiling inside, however.
I noted that Teams popped up in a link to a YCombinator discussion “Why Is Microsoft Teams Still So Bad?.” The comments are informative and interesting; for example:
- Roydivision says: Random crashing.
- Classified says: Once the bean counters discover that you can make money with a piece of software, the game is over.
- M4lvin says: In Germany (or maybe whenever the system language is German) Microsoft decided that everyone should have a Ferris wheel and a bezel in their task bar because now it is Oktoberfest in Munich. Seriously? I think we have reached spam-as-an-operating-system.
- Yawnxyz says: Microsoft product suites are like the Olive Garden of the product world.
- Cyberge99 says: I think Teams also offers more capabilities to Enterprise users. I’ve been on a few teams calls with people on the call that are not visible in the attendee list.
What’s interesting is that:
- People complain but organizations use Microsoft products due to pricing, compliance, institutional momentum, security assertions, familiarity, etc. (Does this mean “monopoly”?)
- Microsoft seems to be assembling a communications equivalent to Word; that is, many features, some of which do not work or cannot be located by a user not intimately familiar with the application. (Is this terminal featuritis?)
- Microsoft’s assertions to the media are not fact checked; otherwise, the comments in the cited thread might be less creditable. (Does science fiction count as a technology deliverable?)
I found the question interesting, but the comments speak more effectively than an equivalent number of TikToks. Viva Teams!
Stephen E Arnold, September 30, 2022
Board Games at Microsoft? Maybe Corner Cutting?
September 30, 2022
I noted a write up called “Anonymous Lays Waste to Russian Message Board, Releases Entire Database Online.” The article describes what a merrie band of anonymous, distributed bad actors can do in today’s decentralized, Web 3 world of online games like Cat and Mouse. The article explains that Mr. Putin’s bureaucracy is a big, fat, and easy target to attack. One statement in the article caught my attention; to wit:
For all their reputation on cyber security and hacking, the Russians were careless…. KiraSec has taken down hundreds of Russian websites, Russian banks like alfabank, bank.yandex.ru, pro-Russian terror-leaning websites, Russian pedophile websites, Russian government websites, Russian porn sites and a lot more. The cyber activists also “hacked various Russian SCADAs and ICS, nuking their systems and completely destroying their industrial machines.”
I immediately thought about Microsoft’s Brad Smith suggesting that more than 1,000 programmers worked to make SolarWinds a household word. My thought was that Microsoft itself may share the systems engineering approach used to protect some Russian information assets. The key word is “careless.” Arrogance, indifference, and probably quite terrible management facilitated the loss of Russian data and the SolarWinds’ misstep.
I then spotted in my news headline stream this article from the UK online outfit The Register: “Excel’s Comedy of Errors Needs a New Script, Not New Scripting.” This article points out that Microsoft has introduced a new feature for Excel. I am not an individual who writes everything in Excel, including holiday greetings and lists of government officials names and email addresses. Some are.
Here’s the passage I circled after I printed out the write up on a piece of paper:
Excel is already the single most dangerous tool to give to civilians. You can get things wrong in Word and PowerPoint all day long, and while they have their own security fun you’re not getting things wrong through a series of tiny letterboxes behind which can live the company’s most important numerical data. The Excel Blunder is its own genre of corporate terror: it brings down companies, it breaches data like a excited whale seeking sunlight, it can make a mockery of pandemic control. And because Excel is the only universal tool most users get for organizing any sort of data, the abuses and perversions it gets put to are endless.
What’s the connection between bad actors hacking Russia, Microsoft’s explanation of the SolarWinds’ misstep, and Excel’s new scripting method?
Insecurity appears to be part of the core business process.
No big deal. Some bad actors and a few cyber security vendors will be happy. Others will be “careless” and maybe clueless. That’s Clue the board game, not the motion picture.
Stephen E Arnold, September 30, 2022
Microsoft Viva: Live to Work, Work to Live
September 29, 2022
I read about a weird Microsoft innovation. No, it’s not about security. No, it’s not about getting a printer to work in Windows 11. No, it’s not about the bloat in Microsoft Edge. And — at least not yet — it’s not about the wild and extremely wonderful world of Microsoft Teams.
The title of the article in Computerworld is “Microsoft Viva Enhancements Address Employee Disconnect in Hybrid Work Environments.” After explaining why humans invented an office or factory to which employees went to complete tasks, the author provides to illustrate why the work from home approach is not a productivity home run. Employees like to get paid and fiddle around. Work is often hard. (I did spot one Italian government employee sitting in a one room office in Sienna doing absolutely nothing. I checked on the fellow three times over three days. Nothing. No visitors. No phone buzzing. Not even a computer in site. Now that’s a reliable worker… doing nothing with style.)
Let’s get to the Microsoft inventions, shall we?
The product/service is Microsoft Viva and it has the usual Redmond touch. There is Viva Pulse and there is Viva Amplify.
What’s up?
According to the write up:
Viva Pulse is designed to enable managers and team leaders to seek regular and confidential feedback on their team’s experience, using smart templates and research-backed questions to help managers pinpoint what’s working well, where to focus, and what actions could be undertaken to address team needs.
And next up:
Viva Amplify is meant to improve communication between leaders and employees. The app centralizes communications campaigns, offers writing guidance to improve message resonance, enables publishing across multiple channels and distribution groups in Microsoft 365, and provides metrics for improvement.
Other extensions may be Viva Answers, Viva Leadership Corner, Viva Engage, and my personal favorite People in Viva.
These products include Microsoft smart software which will perform such managerial magic as answer employee questions. Also the systems will put “collective knowledge to work for all employees.” (I love categorical affirmatives, don’t you. So universal.) There will be a Leadership Corner where employees “can interact directly with leadership, share ideas and perspectives, participate in organization initiatives, and more.”
Okay, I can’t summarize any more.
My take on this is that Microsoft got a group of 20 somethings together, possibly in a coffee shop, and asked them to conjure up a way for employees working on a project in their jammies to communicate. The result is Viva, and it will be pitched by certified partners to big customers as a productivity enhancement tool. If I were trying to sell this to a government agency, I would say, “This is an umbrella under which Teams can operate. Synergy. Shazam! Oh, the first year is free when you renew your existing Microsoft licenses.”
My concern is that the:
- Viva construct will expand the attack service for bad actors
- The numerous moving parts will not move in the way users expect
- Managers will find learning the constantly updating Viva components time consuming and just go walk to phone calls and managing by walking around.
Great innovation? Hardly. To Microsoft, however, this is the equivalent to discovering a new thing to sell and distract people from some of Microsoft’s more interesting issues. Example: Security challenges.
Stephen E Arnold, September 29, 2022
LinkedIn: The Logic of the Greater Good
September 26, 2022
I have accepted two factoids about life online:
First, the range of topics searched from my computer systems available to my research team is broad, diverse, and traverses the regular Web, the Dark Web, and what we call the “ghost Web.” As a result, recommendation systems like those in use by Facebook, Google, and Microsoft are laughable. One example is YouTube’s suggesting that one of my team would like an inappropriate beach fashion show here, a fire on a cruise ship here, humorous snooker shots here, or sounds heard after someone moved to America here illustrate the ineffectuality of Google’s smart recommendation software. These recommendations make clear that when smart software cannot identify a pattern or an intentional pattern disrupting click stream, data poisoning works like a champ. (OSINT fans take note. Data poisoning works and I am not the only person harboring this factoid.) Key factoid: Recommendation systems don’t work and the outputs can be poisoned… easily.
Second, profile centric systems like Facebook’s properties or the LinkedIn social network struggle to identify information that is relevant. Thus, we ignore the suggestions for who is hiring people with your profile and the requests to be friends. These are amusing. Here are some anonymized examples. A female in Singapore wanted to connect me with an escort when I was next in Singapore. I interpreted this as a solicitation somewhat ill suited to a 77 year old male who no longer flies to Washington, DC. Forget Singapore. What about a person who is a sales person at a cable company? Or what about a person who does land use planning in Ecuador? What about a person with 19 years experience as a Google “partner”? You get the idea. Pimps and resellers of services which could be discontinued without warning. Key factoid: Recommendations don’t match that I am retired, give lectures to law enforcement and intelligence professionals, and stay in my office in rural Kentucky, with my lovable computers, a not so lovable French bulldog, and my main squeeze for the last 53 years. (Sorry, Singapore intermediary for escorts. 
)
I read a write up in the indigestion inducing New York Times. I am never sure if the stories are accurate, motivated by social bias, written by a persistent fame seeker, or just made up by a modern day Jayson Blair. For info, click here. (You will have to pay to view this exciting story about fiction presented as “real” news.
The story catching my attention today (Saturday, September 24, 2022) has the title “LinkedIn Ran Social Experiments on 20 Million Users over Five Years?” Obviously the author is not familiar with the default security and privacy settings in Windows 10 and that outstanding Windows 11. Data collection both explicit and implicit is the tension in in the warp and woof of the operating systems’ fabric.
Since Microsoft owns LinkedIn, it did not take me long to conclude that LinkedIn like its precursor Plaxo had to be approached with caution, great caution. The write up reports that some Ivory Tower types figured out that LinkedIn ran and probably still runs tests to determine what can get more users, more clicks, and more advertising dollars for the Softies. An academic stalking horse is usually a good idea.
I did spot several comments in the write up which struck me as amusing. Let’s look at a three:
First, consider this statement:
LinkedIn, which is owned by Microsoft, did not directly answer a question about how the company had considered the potential long term consequences of its experiments on users’ employment and economic status.
No kidding. A big tech company being looked at for its allegedly monopolistic behaviors not directly answering a New York Times’ reporters questions. Earth shaking. But the killer gag for me is wanting to know if Microsoft LinkedIn “consider the potential long term consequences of its experiments.” Ho ho ho. Long term at a high tech outfit is measured in 12 week chunks. Sure, there may be a five year plan, but it probably still includes references to Microsoft’s network card business, the outlook for Windows Phone and Nokia, and getting the menus and icons in Office 365 to be the same across MSFT applications, and pitching the security of Microsoft Azure and Exchange as bulletproof. (Remember. There is a weapon called the Snipex Alligator, but it is not needed to blast holes through some of Microsoft’s vaunted security systems I have heard.)
Second, what about this passage from the write up:
Professor Aral of MIT said the deeper significance of the study was that it showed the importance of powerful social networking algorithms — not just in amplifying problems like misinformation but also as fundamental indications or economic conditions like employment and unemployment.
I think a few people understand that corrosive, disintermediating impact of social media information delivered quickly can have an effect. Examples range from flash mob riots to teens killing themselves because social media just does such a bang up job of helping adolescents deal with inputs from strangers and algorithms which highlight the thrill of blue screening oneself. The excitement of asking people who won’t help one find a job is probably less of a downer but failing to land an interview via LinkedIn might spark binge watching of “Friends.”
Third, I loved this passage:
“… If you want to get more jobs, you should be on LinkedIn more.
Yeah, that’s what I call psychological triggering: Be on LinkedIn more. Now. Log on. Just don’t bother to ask me to add you my network of people whom I don’t know because “Stephen E Arnold” on LinkedIn is managed by different members of my team.
Net net: Which is better? The New York Times or Microsoft LinkedIn. You have 10 minutes to craft an answer which you can post on LinkedIn among the self promotions, weird facts, and news about business opportunities like paying some outfit to put you on a company’s Board of Advisors.
Yeah, do it.
Stephen E Arnold, September 26, 2022
AI Humorously Trolls With Fake LinkedIn Profiles
September 14, 2022
Does anyone take anything on LinkedIn seriously anymore? Beyond cringy posts, scammers use bots to make fake profiles. Bad actors are not the only ones who enjoy poking fun at LinkedIn. Business Insider explains how an AI was designed to create the best sh*ts and giggles to share on the platform: “The Internet Is Having A Field Day With This AI Tool That Pokes Fun At LinkedIn By Making Cringy, Aspirational Posts Celebrating Even The Most Mundane Tasks.”
The Viral Post Generator is an AI tool that creates genius, cringe worthy inspirational advice with buzzwords, jargon, and all the spicy goodness of a wordsmith who can write a beautiful description of rotting trash. The Viral Post Generator works by typing in an activity, then it pops out a less than savory, but inspirational post.
Tom Orbach is a growth marketing manager at the Israeli privacy tech startup Mine. He scraped over 10,000 of LinkedIn’s popular posts and discovered they were mostly self-centered, even a tad narcissistic. He made the Viral Post Generator to make fun of LinkedIn, but Orbach loves LinkedIn:
“’It’s my favorite social network, and I like how positive it is, but it’s just too cringy from time to time,’ Orbach said. ‘I just think that people should be more real and authentic and think of themselves less as thought leaders and more as colleagues. He continued: ‘The posts that go viral are usually narcissistic ones, but it doesn’t have to be that way.’”
Orbach wants people to be more authentic. Hopefully, Orbach will not lose that sense of wonder and trust in humanity, because the Internet kills that within seconds. And what about Microsoft’s smart software bird dogging LinkedIn? Yeah, really.
Whitney Grace, September 14, 2022
-
- Subscribe to Beyond Search
Feature archive
News archive
-
